dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com Open in urlscan Pro
52.213.254.74  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request a8a28e77fe242a313a860f27077bdb7c Show response dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com/api/xgemail/quarantine-summary/release/	12 KB 5 KB	119ms 37ms	Document text/html	52.213.254.74 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com/api/xgemail/quarantine-summary/release/a8a28e77fe242a313a860f27077bdb7c Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.213.254.74 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-213-254-74.eu-west-1.compute.amazonaws.com Software - / Resource Hash 5bd7bb3c0cdebceb776483e1b281c43a1e72ec8ea515c8e97f0da49e357a0623 Security Headers Name Value Content-Security-Policy frame-ancestors 'none' Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-expose-headers ETag cache-control no-store,no-cache,must-revalidate,max-age=0; content-encoding gzip content-security-policy frame-ancestors 'none' content-type text/html;charset=ISO-8859-1 date Wed, 14 Sep 2022 09:26:55 GMT server - strict-transport-security max-age=31536000 vary origin,accept-encoding x-content-type-options nosniff x-frame-options DENY x-xss-protection 1
GET H2	200	401-error-icon.png cloud.sophos.com/assets/	9 KB 9 KB	109ms 37ms	Image image/png	54.170.175.13 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cloud.sophos.com/assets/401-error-icon.png Requested by Host: dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com URL: https://dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com/api/xgemail/quarantine-summary/release/a8a28e77fe242a313a860f27077bdb7c Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.170.175.13 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-170-175-13.eu-west-1.compute.amazonaws.com Software - / Resource Hash 63ae0113d05677d47e0c6cdd274b8667c5ce233fac4dcac0d4b8ea964207ac3f Security Headers Name Value Content-Security-Policy frame-ancestors 'none' Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1 Request headers accept-language de-DE,de;q=0.9 Referer https://dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Wed, 14 Sep 2022 09:26:55 GMT x-content-type-options nosniff last-modified Wed, 07 Sep 2022 14:17:48 GMT server - x-frame-options DENY content-type image/png;charset=UTF-8 cache-control no-store,no-cache,must-revalidate,max-age=0; content-security-policy frame-ancestors 'none' strict-transport-security max-age=31536000 accept-ranges bytes vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers content-length 8843 x-xss-protection 1
GET H2	200	nr-1216.min.js Show response js-agent.newrelic.com/	38 KB 14 KB	38ms 6ms	Script application/javascript	151.101.2.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-1216.min.js Requested by Host: dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com URL: https://dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com/api/xgemail/quarantine-summary/release/a8a28e77fe242a313a860f27077bdb7c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 6f973e7d75a7e6f6e59708f19631c8890034db5debb4d04f189deb53c114e708 Request headers accept-language de-DE,de;q=0.9 Referer https://dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-amz-version-id mHHzJIqOizHibcYt0xqAszRr0gQRiNYy content-encoding gzip etag "9f533d8cd24b2c5e3b4dc886ecbd43e8" x-amz-request-id PT1X3XEF2KF64GRE x-cache HIT cross-origin-resource-policy cross-origin content-length 14391 x-amz-id-2 rWr2JWGo0/hJJpCkOl46Jludz4/khIecVhbiRQQ0qpVwJVN5XkS3fA4iIlbnsr7DzvXsY648nRw= x-served-by cache-hhn4024-HHN last-modified Thu, 14 Apr 2022 16:45:57 GMT server AmazonS3 x-timer S1663147616.568064,VS0,VE0 date Wed, 14 Sep 2022 09:26:55 GMT vary Accept-Encoding content-type application/javascript via 1.1 varnish cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 12631
GET H/1.1	200 OK	3a355ef965 Show response bam.nr-data.net/1/	49 B 625 B	189ms 141ms	Script text/javascript	162.247.241.14 NEWRELIC-AS-1
General Check archive.org Show headers Download Go to Full URL https://bam.nr-data.net/1/3a355ef965?a=490074332&v=1216.487a282&to=NVIEZkcCXBFYVREKCwwYNUJHClwFelkLFxYNWwpXR0xTElAZHQQBD1YPXhoSRwNLVwsXDQxSS0FADl8DS09KEQEOUgdBUExJFlZdAA0ZQh8hd2FK&rst=293&ck=1&ref=https://dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com/api/xgemail/quarantine-summary/release/a8a28e77fe242a313a860f27077bdb7c&ap=8&be=173&fe=244&dc=193&perf=%7B%22timing%22:%7B%22of%22:1663147611480,%22n%22:0,%22f%22:1,%22dn%22:2,%22dne%22:17,%22c%22:17,%22s%22:44,%22ce%22:82,%22rq%22:82,%22rp%22:120,%22rpe%22:122,%22dl%22:127,%22di%22:193,%22ds%22:193,%22de%22:194,%22dc%22:244,%22l%22:244,%22le%22:245%7D,%22navigation%22:%7B%7D%7D&fp=204&fcp=204&jsonp=NREUM.setToken Requested by Host: js-agent.newrelic.com URL: https://js-agent.newrelic.com/nr-1216.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.241.14 , United States, ASN23467 (NEWRELIC-AS-1, US), Reverse DNS Software cloudflare / Resource Hash dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82 Request headers accept-language de-DE,de;q=0.9 Referer https://dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers Date Wed, 14 Sep 2022 09:26:55 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Vary Accept-Encoding access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS Content-Type text/javascript Access-Control-Allow-Origin * Transfer-Encoding chunked Cross-Origin-Resource-Policy cross-origin Connection keep-alive access-control-allow-credentials true CF-Ray 74a81575be8f925b-FRA

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 16Shop (Consumer)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| NREUM object| newrelic function| __nr_require

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: C481B43E658D77AD37D934C7FB4306BC
			.sophos.com/	1969-12-31 23:59:59	Name: SESSION Value: ZjQzZDUzMzktOTNjMC00ZWMwLWJjNjYtNzBhNmFlZmFiZTBm
			.nr-data.net/	1969-12-31 23:59:59	Name: JSESSIONID Value: 79703d32de8eb6fd

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bam.nr-data.net
cloud.sophos.com
dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com
js-agent.newrelic.com
151.101.2.137
162.247.241.14
52.213.254.74
54.170.175.13
5bd7bb3c0cdebceb776483e1b281c43a1e72ec8ea515c8e97f0da49e357a0623
63ae0113d05677d47e0c6cdd274b8667c5ce233fac4dcac0d4b8ea964207ac3f
6f973e7d75a7e6f6e59708f19631c8890034db5debb4d04f189deb53c114e708
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82